Threats Tagged 'cve-2026-75803'

A denial of service vulnerability (CVE-2026-80212) exists in the Ruby resolv gem due to uncontrolled memory growth triggered by crafted DNS responses. This issue affects Red Hat Hardened Images and related Ruby 4.0 packages. Red Hat has issued a security advisory with updated RPMs addressing this vulnerability. No known exploits are reported in the wild. The severity is assessed as high based on the impact of denial of service.

This update includes the following RPMs: rust-bootupd: * bootupd-0.3.2-1.hum1 (aarch64, x86_64) * rust-bootupd-0.3.2-1.hum1.src (src)

This advisory addresses a low severity vulnerability in Red Hat Hardened Images RPMs, specifically related to Ruby 3.4 packages. The update includes multiple RPM packages with bug fixes and enhancements. The vulnerability is identified as CWE-354 (Improper Control of Generation of Code). The advisory references Ubuntu security notices for OpenSSL vulnerabilities but does not provide detailed exploit or impact information specific to the Ruby packages. No known exploits are reported in the wild.

This update includes the following RPMs: ruby3.3: * ruby3.3-3.3.10-23.6.hum1 (aarch64, x86_64) * ruby3.3-bundled-gems-3.3.10-23.6.hum1 (aarch64, x86_64) * ruby3.3-default-gems-3.3.10-23.6.hum1 (noarch) * ruby3.3-devel-3.3.10-23.6.hum1 (aarch64, x86_64) * ruby3.3-doc-3.3.10-23.6.hum1 (noarch) * ruby3.3-libs-3.3.10-23.6.hum1 (aarch64, x86_64) * rubygem3.3-bigdecimal-3.1.5-23.6.hum1 (aarch64, x86_64) * rubygem3.3-bundler-2.5.22-23.6.hum1 (noarch) * rubygem3.3-devel-3.5.22-23.6.hum1 (noarch) * rubygem3.3-io-console-0.7.1-23.6.hum1 (aarch64, x86_64) * rubygem3.3-irb-1.13.1-23.6.hum1 (noarch) * rubygem3.3-json-2.7.2-23.6.hum1 (aarch64, x86_64) * rubygem3.3-minitest-5.20.0-23.6.hum1 (noarch) * rubygem3.3-power_assert-2.0.3-23.6.hum1 (noarch) * rubygem3.3-psych-5.1.2-23.6.hum1 (aarch64, x86_64) * rubygem3.3-racc-1.7.3-23.6.hum1 (aarch64, x86_64) * rubygem3.3-rake-13.1.0-23.6.hum1 (noarch) * rubygem3.3-rbs-3.4.0-23.6.hum1 (aarch64, x86_64) * rubygem3.3-rdoc-6.6.3.1-23.6.hum1 (noarch) * rubygem3.3-rexml-3.4.4-23.6.hum1 (noarch) * rubygem3.3-rss-0.3.1-23.6.hum1 (noarch) * rubygem3.3-rubygems-3.5.22-23.6.hum1 (noarch) * rubygem3.3-test-unit-3.6.1-23.6.hum1 (noarch) * rubygem3.3-typeprof-0.21.9-23.6.hum1 (noarch) * ruby3.3-3.3.10-23.6.hum1.src (src) Security Fix(es): ruby3.3: * CVE-2026-80212 * CVE-2026-80213

This update includes the following RPMs: openssl: * openssl-3.5.8-0.1.hum1 (aarch64, x86_64) * openssl-config-fips-3.5.8-0.1.hum1 (aarch64, x86_64) * openssl-devel-3.5.8-0.1.hum1 (aarch64, x86_64) * openssl-devel-engine-3.5.8-0.1.hum1 (aarch64, x86_64) * openssl-fips-provider-upstream-3.5.8-0.1.hum1 (aarch64, x86_64) * openssl-libs-3.5.8-0.1.hum1 (aarch64, x86_64) * openssl-perl-3.5.8-0.1.hum1 (aarch64, x86_64) * openssl-3.5.8-0.1.hum1.src (src)

This update includes the following RPMs: openssl3: * openssl3-devel-3.5.8-0.1.hum1 (aarch64, x86_64) * openssl3-devel-engine-3.5.8-0.1.hum1 (aarch64, x86_64) * openssl3-libs-3.5.8-0.1.hum1 (aarch64, x86_64) * openssl3-3.5.8-0.1.hum1.src (src)

A security update for Red Hat Hardened Images addresses multiple vulnerabilities in OpenSSL 3, including memory growth issues, heap buffer overflows, invalid pointer dereferences, and cryptographic forgery risks. These vulnerabilities affect various components such as QUIC server processing, CMP response validation, and PKCS#12 file handling. The update fixes these issues in OpenSSL version 3.5.6-0.5.hum1 and related packages.